Continuous Testing Tools DSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is planning to adopt a shift-left testing strategy. They currently rely on DAST scans in production and want to move security testing earlier. They have limited budget and want to get the most value for their investment. Which combination of actions would best achieve shift-left testing?

   • AContinue with DAST in production and increase the frequency of scans.
   • BIntegrate SAST into the IDE and CI pipeline, and add SCA for dependency scanning, while keeping DAST for pre-production staging.
   • COnly use IAST in production, since it provides runtime analysis.
   • DReplace all security testing with a single annual penetration test.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A team wants to identify security vulnerabilities in their Java application's source code before the code is compiled or deployed. They want the scan to run quickly and provide line-level findings to developers. Which type of tool should they integrate into their CI pipeline?

   • AA software composition analysis (SCA) tool that checks open-source dependencies for known vulnerabilities.
   • BA dynamic application security testing (DAST) tool that scans the running application from the outside.
   • CA static application security testing (SAST) tool that analyzes the source code for known vulnerability patterns.
   • DAn interactive application security testing (IAST) tool that monitors the application during runtime.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a key advantage of IAST over traditional SAST and DAST?

   • AIt only scans open-source components
   • BIt can be used without any integration into the application
   • CIt does not require the application to be running
   • DIt provides real-time detection with lower false positives
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In a CI/CD pipeline, when are automated tests typically triggered?

   • AOn every code commit or merge to the shared repository
   • BOnly when a developer manually triggers them
   • COnly when a new release is scheduled for production
   • DOnly after all code has been reviewed by a human
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is receiving hundreds of SAST findings every week, but developers are only fixing a small fraction. Analysis shows that many findings are duplicates across modules or are false positives. The team wants to increase the remediation rate without overwhelming developers. Which approach is most effective?

   • ACreate a dashboard that shows all findings but do not notify developers.
   • BStop running SAST and rely on penetration testing once a year.
   • CDeduplicate findings, tune the SAST rules to reduce false positives, and route only new high-severity issues to developers with clear remediation guidance.
   • DSend all findings to developers and require them to fix every one within a week.
   Reveal Solution Discussion Select an answer first